What the Proxmox Hardening Guide for PVE 9 and PBS 4 covers and misses

The updated guide extends its checklist-style hardening approach to Proxmox VE 9.x and Proxmox Backup Server 4.x, building on the earlier coverage of PVE 8 and PBS 3. It maps general Debian CIS recommendations onto how Proxmox actually works, with the aim of turning baseline OS hardening into something usable on virtualization hosts and backup servers.

The guide concentrates on practical controls such as SSH hardening, network separation, enabling the firewall, logging, and auditd integration. It stresses limiting what the host can talk to and shrinking the exposed surface, especially in clusters. The checklist format is meant to keep it actionable instead of turning into an abstract security manifesto.

Several high-priority themes still need clearer treatment. The first is privileged access management in a Proxmox context. Debian CIS assumes least-privilege administration through sudo, while Proxmox often defaults to direct root use and API tokens. A hardened design should spell out a root account policy: no daily root logins, restricted SSH access, and per-user accounts with tightly scoped ACL roles.

The second is mapping Proxmox RBAC roles to access on the underlying OS. With well-structured roles and permissions, administrators should rarely need an interactive shell. Clear “design patterns” for sudoers configuration, break-glass procedures, and audit logging of privileged actions would bring the theory closer to day-to-day operations.

Advanced network segmentation such as netns and VRF is also debated. It is attractive on paper, but many argue the complexity is not worth the benefit for most deployments. A more realistic baseline is strict network separation and firewall enforcement, with hypervisors consuming the network instead of taking part in routing domains.

Overall, the guide is a strong technical foundation. It would be better with more explicit guidance on root governance, on mapping RBAC to the OS, and on administrative design patterns that work in practice.